It's not clear whether you are talking about models or databases. The model is defined during the request and exists only during the request. You don't have to change the name of the model or delete it at the end of the request. You could do:
db = DAL([connection string that is specific to this user], ...)
db.define_table('mytable', ...)
When User A makes a request, db will be a connection to that user's database, and db.mytable will therefore be a model of the "mytable" table in User A's database. When User B makes a request, db will be a connection to a different database, and db.mytable will be a model of the "mytable" table in that database. These objects will be created in different threads and exist only as long as the request lasts.
The question is, what happens with all of these databases? Do you really want one for every session, or just one for every registered user. If the latter, do you want the data to persist over time (i.e., beyond the session)? If so, don't use the session ID to name the database.
Note, it can be tricky to figure out when a session ends. Technically, the session cookie should last until the user closes their browser, but you can't know when that happens. As an alternative, you could define some time limit of inactivity and automatically expunge any data associated with a session that has been inactive for too long.
Anthony